The Offside Wallet Theft Factory Firefox Add-ons

What happened

Operators published add-ons that looked like sports tools, then pushed updates under the same Firefox IDs that carried wallet-stealing code. Socket's report counts 77 linked identities. Of these, 40 are confirmed malicious and 37 are sports-score shells. The shells advertised unrelated functions such as password generation, VPN, screenshots and note-taking, but showed sports scores.

Nine of the malicious IDs began as sports-score shells for football, basketball, NBA or American football. Later versions under the same IDs became fake wallets that impersonate Rabby, OKX or TronLink. A user who installed the harmless version received the update through the normal add-on update path.

Socket groups the 40 malicious add-ons by method.

• Seven query attacker-controlled Supabase projects to fetch phishing URLs, so the operators change targets without a new release.
• Fifteen send secrets to Cloudflare Workers. Five of these are modified Rabby builds that capture 12 or 24 word recovery phrases.
• Thirteen are modified Rabby builds that change persistAllKeyrings() to send serialized keyring data before encryption, by plain HTTP POST.
• Five collect credentials and clipboard contents and send them to a hardcoded server.

CryptoSlate and CyberInsider report the same counts and the same March to August 2026 window.

Affected versions

Nine Firefox IDs are confirmed to have changed from a sports version to a wallet-stealing version. Socket lists these pairs.

Socket's names use look-alike characters, so the table shows plain forms. Match on the Firefox ID. Mozilla removed live add-ons during the investigation.

Indicators of compromise

Socket lists these indicators. Defanged forms are written as in the report.

• Cloudflare Worker dry-bush-5408[.]animalrescueeducationcenter-org[.]workers[.]dev with campaign token EQOx7EIPZSNi
• Other Workers: winter-smoke-a612[.]icy-star-f45c[.]workers[.]dev, quiet-thunder-ade3[.]bankoganger[.]workers[.]dev and winter-waterfall-0606[.]rihaniomar21[.]workers[.]dev
• Keyring exfiltration hosts gemachriverdale[.]org:9000 and e-wl[.]com:9000
• Server 77[.]91[.]100[.]175, paths /html/app[.]php and /html/continue[.]php
• Phishing page portal-web3-extension-welcome[.]pages[.]dev/home, loaded by the add-on 0KX WEB3
• Supabase project IDs kyfyvuwifdukctqyggto, acrfruxtmulgvyvtbwgq, efiukydskwkeatexavdp, mzghdnikguesdamuxjbm, nxsixihozitybwrbahiu, yvqmtnmeivrcyomyeouz and vgksucdjccsojzuhckzk
• A shared API-Sports credential in the 32 football shells, which query v3.football.api-sports.io/fixtures?live=all

How to check

List your installed Firefox add-ons and search for the nine IDs. On macOS, this command reads your profile data and changes nothing. On Linux, use ~/.mozilla/firefox as the path.

grep -lE "bright-save-feed@tabtools.org|swift-clip-link@fasttools.co|deep-tip-sharp@browsify.co|bolt-save-vault@devplugs.co|core-note-nova@webtools.net|gear-save-tip@extrakits.example|flex-lab-save@foxplugin.co|pure-net-snap@fasttools.co|fast-zip-true@smartext.co" ~/Library/Application\ Support/Firefox/Profiles/*/extensions.json

A file name in the output means one of the IDs is or was installed in that profile. Also open about:support in Firefox and read the Extensions list for any wallet add-on you did not install on purpose.

What to do now

1. Remove any matching add-on from Firefox.
2. If you typed a recovery phrase or private key into one of these add-ons, treat it as stolen. Socket states that removing the add-on cannot revoke a secret that was already sent.
3. Create a new wallet from a new recovery phrase and move your remaining assets to it.
4. If only credentials or clipboard contents were exposed, change the passwords, end active sessions and check destination addresses before you send funds.
5. Review add-on activity after each update, because these add-ons changed after install.

This case shows an update that adds a new capability to an artifact that was clean before. Vigilance compares the version you trust with a new one and reports the file that gained a new capability. See the full attack list and download Vigilance.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 73 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   background.js
           It downloads from the internet and reads saved passwords and access keys.

Sources

1. socket.dev/blog/firefox-crypto-wallet-theft
2. cryptoslate.com/firefox-crypto-wallet-malware-hid-behind-nine-sports-add-ons-turning-routine-updates-into-a-key-rotation-trap/
3. cyberinsider.com/40-malicious-firefox-extensions-caught-stealing-crypto-wallet-data/